The attacker provides an internal IP or hostname. The server fetches it from inside the network, where internal services trust each other.
• http://10.0.0.1/admin — internal admin panel, no auth required from inside
• http://192.168.1.1/ — internal router management interface
• http://internal-db:5432/ — port probe on database host
• http://kubernetes.default.svc/api/v1/ — Kubernetes API server (if running in K8s)
Every major cloud provider exposes a metadata endpoint at a fixed link-local IP. Only accessible from within the instance — but SSRF makes the server fetch it.
• AWS: http://169.254.169.254/latest/meta-data/iam/security-credentials/ — returns temporary IAM credentials
• GCP: http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token — returns OAuth2 access token
• Azure: http://169.254.169.254/metadata/identity/oauth2/token — returns managed identity token
If the server uses a URL-fetching library that supports file:// URLs, the attacker can read files from the server’s local filesystem.
• file:///etc/passwd — user account list on Linux
• file:///etc/shadow — password hashes (if permissions allow)
• file:///app/config.yml — application configuration, database credentials